Systems and methods for interdependent identity based credential collection validation

ABSTRACT

A system for digitally verifying credential sets and its method of use are provided. A credentials set is made up of a number of credentials, each linked to a particular Entity. If all of the credentials are validated and verified, then the credentials&#39; status identifier will be set to a value. If the various status identifiers meet a predetermined value, the set will be verified and digitally signed.

CLAIM OF PRIORITY

This application claims no priority to any previous patent or patentapplication.

FIELD OF THE EMBODIMENTS

This invention relates to systems and methods for InterdependentCredential Verification.

BACKGROUND OF THE EMBODIMENTS

Today, there are over 72 million adults in the United States who hold atleast 1 or more government-issued professional licenses or certificatesthat are required for employment or to operate a business or practice intheir chosen field; in healthcare alone, there are over 18 millionstate-issued licenses, registrations and certifications. Additionally,there exist over 90,000 professional associations whose membershipincludes more than 25,000,000 professionals throughout the country. Manyassociations enable their members to become certified as a result ofpassing rigorous testing as well as demonstrating relevant industryskills and experience. Many business entities depend on the authenticityof these certifications before they will hire, engage, or appointprofessionals to various positions.

Traditionally, issuing institutions (“Issuers”) commit significantresources to administer (i.e. store, track, print, mail) paper-basedcertificates that cannot be readily verified by third parties. As such,efforts to confirm authenticity often take the form of requests frominterested parties to the Issuers to verify a given certificate.

The method of the present invention is integrated by software developersof Credential processing, instructional delivery, testing, human capitalmanagement, professional networking, and other relevant areas.

Issuers that leverage the method of the present invention candramatically reduce their staff time and costs in administeringcertifications. Additionally, the dynamic updating feature of thepresent invention, allows viewers of micro-Credentials to be 100%confident of their authenticity.

Examples of related art are described below:

Regarding art that provides for a secure identification and CredentialVerification system (and methods thereof):

U.S. Pat. No. 8,517,254 discloses a method and apparatus for verifyingthe validity of identification cards. A card reading device reads an IDcard and transmits a request to a database server. A database is queriedand a reply is sent back to the card reading device indicating whetherthe ID is valid. The system can also log and timestamp events for futureaccess.

U.S. Pat. No. 8,406,480 discloses a method for verifying a visualCredential such as a Credential by assigning a security level andpredetermined thresholds relating to visual Credential matching theindividual. A comparison module determines whether or not the unverifiedCredential is valid or invalid by comparing the image of the unverifiedCredential with known good images of valid Credentials.

United States Publication No. 2013/0275753 teaches a system forverifying Credentials comprising a plurality of Credential Verificationservers both on a local and remote server.

U.S. Pat. No. 8,620,676 discloses an electronic Credential Verificationsystem which is comprised of electronic Credential records, a databaseto store such Credentials, real time access to the database,verification data and storage; and automatic and continuous verificationof Credentials.

Further, much of the prior art deals with fraud detection andprotection.

U.S. Pat. No. 8,713,650 discloses a computer implemented system todetect fraudulent data which performs a comparison of informationrelated to an Identity Document of a first subscriber with prioractivity data corresponding to prior use of that same Identity Document,the prior activity data received from a device of a second subscriberand stored in the database.

U.S. Pat. No. 7,617,970 teaches a system that creates a computer scoreand depending on the computed scoring, the system determines whether ornot the individual's ID Credential scoring is sufficient to verify theindividual or reject an individual ID Credentials.

United States Publication No. 2013/0191898 discloses a method forfacilitating the authentication and verification of a user by creatingand maintaining a true online Credential (TOC). The TOC is comprised ofa personally identifiable information of a user and aknowledge-based-authentication (KBA) question and response.

United States Publication No. 20110197267 teaches a system forauthenticating an Identity of a user of a client device (mobile orotherwise) as part of a transaction between the client device and aserver of a service provider over a communications network.

U.S. Pat. No. 4,716,593 teaches an Identity verification system based onspeech rather than ID Credentials.

An understanding of Digital Credentials and the current process isnecessary to understand the present invention. Exchanging DigitalCredentials is generally an electronic process. The process primarilyinvolves at least two parties: 1) An Issuer, who is responsible forissuing the Digital Credential and, 2) the Recipient, who is the Entitythat is the focus of the Credential's Claim. The Issuer uses a softwareapplication to create and store a Digital Credential, which softwareapplication then notifies the Recipient of the existence of saidCredential for the Recipient to store in another software applicationcapable of curating Digital Credentials on behalf of the Recipient.

The W3C Credentials Group (“CG”) has proposed a specification fordescribing how Issuers will create and deliver a Digital Credential to aRecipient. In this model, a software application requests Identityinformation from the Recipient, such as a decentralized identifier(DID), which is provided by Recipient's Identity Provider (“IdP”)through a standardized web protocol especially designed to communicateDigital Credentials and DIDs called the Credential Transport Protocol(“CTP”). A web service, known as WebDHT, is designed to communicate andmanage DIDs over the internet. Once the IdP authenticates the Recipient,the IdP composes and sends out an Identity Document that contains theRecipient's DID. The Issuer then creates and stores a Digital Credentialthat contains a reference to the Recipient's DID and notifies theRecipient of the existence of a newly issued Credential. When theRecipient claims the Digital Credential, it is sent from the Issuer'sCredential storage system to the Recipient's curation system using theCTP. IdPs who support CTP usually provide a Digital Credential curationsystem. The W3C specification goes on to describe how to applystandardized cryptography using public/private key (PKI) encryptionmethods to sign a Digital Credential's meta-data. Digitally signedCredentials can be systematically verified to ensure that the meta-datahas not been tampered with prior to further inspection by the Entityevaluating or consuming the Digital Credential. Using PKI encryptioninvolves signing the Digital Credential's meta-data with a Private Keyowned by the Issuer. A signed Digital Credential contains a DigitalSignature value within the Digital Credential meta-data, which isverified using the corresponding Public Key derived from the Issuer'sPrivate Key. Metaphorically speaking, the Private Key “locks the door,but can't open it”; the Public Key “opens the door but can't lock it.”The Digital Signature contained in the Digital Credentials ensures thatis was composed by the owner (generally the Recipient) of thePublic/Private Key, and is used to verify that the meta-data containedin the Digital Credential has not been modified after it was originallysigned with the Issuer's Private Key.

The following is a use case example of the above Digital Credentialprocess methodology:

There are many types of Issuers that can exist: Two types such entitiesare educational institutions and healthcare providing institutions.Educational institutions will be able to provide validated DigitalCredentials for people who have already earned them, or preferably, astudent will take a test provided by the educational institution thathas already been optimized for the system of the present invention. Anexample of the latter is now provided:

A student (the Recipient in this illustration) goes to an educationalinstitution's (the Issuer) test center and sits down at a computer. Theeducational institution needs to acquire the Student's DID so it will beable to issue him a Digital Credential once his test results areevaluated. To do this, the educational institution's computerizedtesting system requests an email Credential from student's IdP, whichsends an Identity Document back to the institutions testing system thatcontains the student's DID, a link to the student's Email AddressDigital Credential, and a Digital Signature proving that the informationis owned by student. The student's DID and email address (ascertainedfrom their verified Email Address Digital Credential) are stored andassociated with their submitted test answers in the institution'stesting system. The testing system then evaluates the results.

Given predetermined criterion are met through the evaluation of the testresults, the institution will create a Digital Credential thatrepresents the student's achievement. The educational institution'stesting system issues a Digital Credential containing Claims(“meta-data”) representing the student's achievement to the student'sDID and digitally signs the meta-data with the institution's PrivateKey. The institution's testing system then notifies the student that aDigital Credential is now ready to be claimed by him. The student logsinto his IdP, and is presented with the Digital Credential by theinstitution's testing system. The student then claims the DigitalCredential, which is then communicated and curated at the student's IdP.

Assume that after this process the student then visits a company'swebsite to apply for a job. In order to apply for a specific job, thecompany requires that the student (or job applicant) have met aptitudecriteria. The student has a Credential containing Claims that match therequired aptitude criteria. The student wishes to offer the DigitalCredential as a proof of his aptitude Claims. The company's websiterequests the student's DID and is directed to the student's IdP to allowhim to authorize the transmission of the requested Digital Credential tothe company's job application system. The job application system, uponreceipt of the Digital Credential, may inspect the data integrity of theCredential by verifying the Digital Signature contained in the DigitalCredential prior to storing the meta-data. After the Digital Credentialis verified and stored in the job application system, the HR decisionmaker can be assured that the applicant meets the criteria for the joband may proceed accordingly.

The institution, student, and HR decision maker all have variousincentives for participating in the system:

-   -   Educational institutions can protect their brand and integrity        of the Credentials they issue.    -   Students identities are protected by use of DID and may curate        their Credentials at the IdP of their choice.    -   HR departments are assured they are making informed decisions        based on trusted information about applicants.

As noted, the present invention is particularly suited to serve healthcare providers as well. In one embodiment, the present inventionoperates as follows:

A pharmacy needs to fulfill a prescription (“script”) for a customer.The doctor who writes the script will issue a digitally signed DigitalCredential with her private key, which contains the script informationand the patient's DID (collectively “meta-data”). Linked to the script'sCredential is another Digital Credential that contains the doctor'sLicense, DEA Registration, National Provider Identifier (NPI),Medicare/Medicaid Enrollment Status and Exclusion/Debarment status.Prior to filling and handing over the prescription to the patient, thepharmacy needs to: ensure the doctor's credentials are valid and none ofthem violate a business rule; that the prescription data has not beentampered with; and prove the Identity of the person picking up theprescription is associated with or an official proxy of the DID. Thepharmacy prescription system can verify all of the above using thepresent invention by independently validating: the prescription DigitalCredential; verifying the prescriber's Digital Credential; and using theDID to get proof of the patient's Identity or proxy at the point of saleterminal.

SUMMARY OF THE EMBODIMENTS

The present invention provides for a system, comprising: a memory thatstores computer-executable instructions; and a processor,communicatively coupled to said memory that facilitates execution of thecomputer-executable instructions which provides a Credential setcomprising: at least one Credential having at least one item oflegitimate information and a status identifier; wherein the systemvalidates the format of the at least one Credential and determineswhether the status identifier of the Credential satisfies a verificationparameter of a Credential set, wherein said system transforms the statusidentifier into a set status identifier, and wherein said system usesthe set status identifier to verify the Credential set, provided thatthe set status identifier meets a predetermined value. The system mayalso digitally sign the verified Credential set. The Credential andCredential Sets may be digital.

The present invention also provides for a method for InterdependentCredential Verification of a set, comprising the steps of: providing, atleast one Credential, said at least one Credential comprising at leastone item of legitimate information and at least one status identifier;defining, a Credential set comprising at least one Credential,comprising at least one item of information, and a status identifier;validating, the format of said at least one Credential; determiningwhether the at least one Credential satisfies the parameter of theCredential set; transforming, said status identifier into a set statusidentifier; and verifying said Credential set, provided that said setstatus identifier meets a predetermined value. The method may alsoinclude digitally signing said verified Credential set.

It is an object of the present invention to create a system that allowssets of interdependent Credentials to be digitally verified.

It is an object of the present invention to maintain a database of setsof interdependent Credentials for a plurality of users involving anumber of different certifications.

It is an object of the present invention to provide a clearinghouse forportable interdependent Credentials that are not tied to a singleEntity.

It is an object of the present invention to simplify the verification ofinterdependent Credentials of a given Entity.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a decision tree of an embodiment of the method of thepresent invention.

FIG. 2 shows a flow chart illustrating an embodiment of the method ofthe present invention.

DESCRIPTION OF THE PREFERRED EMBODIMENTS

The preferred embodiments of the present invention will now be describedwith reference to the drawings. Identical elements in the variousfigures are identified with the same reference numerals.

Reference will now be made in detail to each embodiment of the presentinvention. Such embodiments are provided by way of explanation of thepresent invention, which is not intended to be limited thereto. In fact,those of ordinary skill in the art may appreciate upon reading thepresent specification and viewing the present drawings that variousmodifications and variations can be made thereto.

Typically, a user or users, which may be people or groups of usersand/or other systems, may engage information technology systems (e.g.,computers) to facilitate operation of the system and informationprocessing. In turn, computers employ processors to process informationand such processors may be referred to as central processing units(“CPU”). One form of processor is referred to as a microprocessor. CPUsuse communicative circuits to pass binary encoded signals acting asinstructions to enable various operations. These instructions may beoperational and/or data instructions containing and/or referencing otherinstructions and data in various processor accessible and operable areasof memory (e.g., registers, cache memory, random access memory, etc.).Such communicative instructions may be stored and/or transmitted inbatches (e.g., batches of instructions) as programs and/or datacomponents to facilitate desired operations. These stored instructioncodes, e.g., programs, may engage the CPU circuit components and othermotherboard and/or system components to perform desired operations. Onetype of program is a computer operating system, which, may be executedby CPU on a computer; the operating system enables and facilitates usersto access and operate computer information technology and resources.Some resources that may be employed in information technology systemsinclude: input and output mechanisms through which data may pass intoand out of a computer; memory storage into which data may be saved; andprocessors by which information may be processed. These informationtechnology systems may be used to collect data for later retrieval,analysis, and manipulation, which may be facilitated through a databaseprogram. These information technology systems provide interfaces thatallow users to access and operate various system components.

In one embodiment, the present invention may be connected to and/orcommunicate with Entities such as, but not limited to: one or more usersfrom user input devices; peripheral devices; an optional cryptographicprocessor device; and/or a communications network. For example, thepresent invention may be connected to and/or communicate with usersoperating client device(s), including, but not limited to, personalcomputer(s), server(s) and/or various mobile device(s) including, butnot limited to, cellular telephone(s), smartphone(s) (e.g., iPhone®,Blackberry®, Android OS-based phones etc.), tablet computer(s) (e.g.,Apple iPad™ HP Slate™, Motorola Xoom™, etc.), eBook reader(s) (e.g.,Amazon Kindle™, Barnes and Noble's Nook™ eReader, etc.), laptopcomputer(s), notebook(s), netbook(s), gaming console(s) (e.g., XBOXLive™, Nintendo® DS, Sony PlayStation® Portable, etc.), portablescanner(s) and/or the like.

Networks are commonly thought to comprise the interconnection andinteroperation of clients, servers, and intermediary nodes in a graphtopology. It should be noted that the term “server” as used throughoutthis application refers generally to a computer, other device, program,or combination thereof that processes and responds to the requests ofremote users across a communications network. Servers serve theirinformation to requesting “clients.” The term “client” as used hereinrefers generally to a computer, program, other device, user and/orcombination thereof that is capable of processing and making requestsand obtaining and processing any responses from servers across acommunications network. A computer, other device, program, orcombination thereof that facilitates, processes information andrequests, and/or furthers the passage of information from a source userto a destination user is commonly referred to as a “node.” Networks aregenerally thought to facilitate the transfer of information from sourcepoints to destinations. A node specifically tasked with furthering thepassage of information from a source to a destination is commonly calleda “router.” There are many forms of networks such as Local Area Networks(LANs), Pico networks, Wide Area Networks (WANs), Wireless Networks(WLANs), etc. For example, the Internet is generally accepted as beingan interconnection of a multitude of networks whereby remote clients andservers may access and interoperate with one another.

The present invention may be based on computer systems that maycomprise, but are not limited to, components such as: a computersystemization connected to memory.

Computer Systemization

A computer systemization may comprise a clock, central processing unit(“CPU(s)” and/or “processor(s)” (these terms are used interchangeablethroughout the disclosure unless noted to the contrary)), a memory(e.g., a read only memory (ROM), a random access memory (RAM), etc.),and/or an interface bus, and most frequently, although not necessarily,are all interconnected and/or communicating through a system bus on oneor more (mother)board(s) having conductive and/or otherwise transportivecircuit pathways through which instructions (e.g., binary encodedsignals) may travel to effect communications, operations, storage, etc.Optionally, the computer systemization may be connected to an internalpower source; e.g., optionally the power source may be internal.Optionally, a cryptographic processor and/or transceivers (e.g., ICs)may be connected to the system bus. In another embodiment, thecryptographic processor and/or transceivers may be connected as eitherinternal and/or external peripheral devices via the interface bus I/O.In turn, the transceivers may be connected to antenna(s), therebyeffectuating wireless transmission and reception of variouscommunication and/or sensor protocols; for example the antenna(s) mayconnect to: a Texas Instruments WiLink WL1283 transceiver chip (e.g.,providing 802.11n, Bluetooth 3.0, FM, global positioning system (GPS)(thereby allowing the controller of the present invention to determineits location)); Broadcom BCM4329FKUBG transceiver chip (e.g., providing802.11n, Bluetooth 2.1+EDR, FM, etc.); a Broadcom BCM4750IUB8 receiverchip (e.g., GPS); an Infineon Technologies X-Gold 618-PMB9800 (e.g.,providing 2G/3G HSDPA/HSUPA communications); and/or the like. The systemclock typically has a crystal oscillator and generates a base signalthrough the computer systemization's circuit pathways. The clock istypically coupled to the system bus and various clock multipliers thatwill increase or decrease the base operating frequency for othercomponents interconnected in the computer systemization. The clock andvarious components in a computer systemization drive signals embodyinginformation throughout the system. Such transmission and reception ofinstructions embodying information throughout a computer systemizationmay be commonly referred to as communications. These communicativeinstructions may further be transmitted, received, and the cause ofreturn and/or reply communications beyond the instant computersystemization to: communications networks, input devices, other computersystemizations, peripheral devices, and/or the like. Of course, any ofthe above components may be connected directly to one another, connectedto the CPU, and/or organized in numerous variations employed asexemplified by various computer systems.

The CPU comprises at least one high-speed data processor adequate toexecute program components for executing user and/or system-generatedrequests. Often, the processors themselves will incorporate variousspecialized processing units, such as, but not limited to: integratedsystem (bus) controllers, memory management control units, floatingpoint units, and even specialized processing sub-units like graphicsprocessing units, digital signal processing units, and/or the like.Additionally, processors may include internal fast access addressablememory, and be capable of mapping and addressing memory beyond theprocessor itself; internal memory may include, but is not limited to:fast registers, various levels of cache memory (e.g., level 1, 2, 3,etc.), RAM, etc. The processor may access this memory through the use ofa memory address space that is accessible via instruction address, whichthe processor can construct and decode allowing it to access a circuitpath to a specific memory address space having a memory state. The CPUmay be a microprocessor such as: AMD's Athlon, Duron and/or Opteron;ARM's application, embedded and secure processors; IBM and/or Motorola'sDragonBall and PowerPC; IBM's and Sony's Cell processor; Intel'sCeleron, Core (2) Duo, Itanium, Pentium, Xeon, and/or XScale; and/or thelike processor(s). The CPU interacts with memory through instructionpassing through conductive and/or transportive conduits (e.g., (printed)electronic and/or optic circuits) to execute stored instructions (i.e.,program code) according to conventional data processing techniques. Suchinstruction passing facilitates communication within the presentinvention and beyond through various interfaces. Should processingrequirements dictate a greater amount speed and/or capacity, distributedprocessors (e.g., Distributed embodiments of the present invention),mainframe, multi-core, parallel, and/or super-computer architectures maysimilarly be employed. Alternatively, should deployment requirementsdictate greater portability, smaller Personal Digital Assistants (PDAs)may be employed.

Depending on the particular implementation, features of the presentinvention may be achieved by implementing a microcontroller such asCAST's R8051XC2 microcontroller; Intel's MCS 51 (i.e., 8051microcontroller); and/or the like. Also, to implement certain featuresof the various embodiments, some feature implementations may rely onembedded components, such as: Application-Specific Integrated Circuit(“ASIC”), Digital Signal Processing (“DSP”), Field Programmable GateArray (“FPGA”), and/or the like embedded technology. For example, any ofthe component collection (distributed or otherwise) and/or features ofthe present invention may be implemented via the microprocessor and/orvia embedded components; e.g., via ASIC, coprocessor, DSP, FPGA, and/orthe like. Alternately, some implementations of the present invention maybe implemented with embedded components that are configured and used toachieve a variety of features or signal processing.

Depending on the particular implementation, the embedded components mayinclude software solutions, hardware solutions, and/or some combinationof both hardware/software solutions. For example, features of thepresent invention discussed herein may be achieved through implementingFPGAs, which are a semiconductor devices containing programmable logiccomponents called “logic blocks”, and programmable interconnects, suchas the high performance FPGA Virtex series and/or the low cost Spartanseries manufactured by Xilinx. Logic blocks and interconnects can beprogrammed by the customer or designer, after the FPGA is manufactured,to implement any of the features of the present invention. A hierarchyof programmable interconnects allow logic blocks to be interconnected asneeded by the system designer/administrator of the present invention,somewhat like a one-chip programmable breadboard. An FPGA's logic blockscan be programmed to perform the function of basic logic gates such asAND, and XOR, or more complex combinational functions such as decodersor simple mathematical functions. In most FPGAs, the logic blocks alsoinclude memory elements, which may be simple flip-flops or more completeblocks of memory. In some circumstances, the present invention may bedeveloped on regular FPGAs and then migrated into a fixed version thatmore resembles ASIC implementations. Alternate or coordinatingimplementations may migrate features of the controller of the presentinvention to a final ASIC instead of or in addition to FPGAs. Dependingon the implementation all of the aforementioned embedded components andmicroprocessors may be considered the “CPU” and/or “processor” for thepresent invention.

Power Source

The power source may be of any standard form for powering smallelectronic circuit board devices such as the following power cells:alkaline, lithium hydride, lithium ion, lithium polymer, nickel cadmium,solar cells, and/or the like. Other types of AC or DC power sources maybe used as well. In the case of solar cells, in one embodiment, the caseprovides an aperture through which the solar cell may capture photonicenergy. The power cell is connected to at least one of theinterconnected subsequent components of the present invention therebyproviding an electric current to all subsequent components. In oneexample, the power source is connected to the system bus component. Inan alternative embodiment, an outside power source is provided through aconnection across the I/O interface. For example, a USB and/or IEEE 1394connection carries both data and power across the connection and istherefore a suitable source of power.

Interface Adapters

Interface bus(ses) may accept, connect, and/or communicate to a numberof interface adapters, conventionally although not necessarily in theform of adapter cards, such as but not limited to: input outputinterfaces (I/O), storage interfaces, network interfaces, and/or thelike. Optionally, cryptographic processor interfaces similarly may beconnected to the interface bus. The interface bus provides for thecommunications of interface adapters with one another as well as withother components of the computer systemization. Interface adapters areadapted for a compatible interface bus. Interface adaptersconventionally connect to the interface bus via a slot architecture.Conventional slot architectures may be employed, such as, but notlimited to: Accelerated Graphics Port (AGP), Card Bus, (Extended)Industry Standard Architecture ((E)ISA), Micro Channel Architecture(MCA), NuBus, Peripheral Component Interconnect (Extended) (PCI(X)), PCIExpress, Personal Computer Memory Card International Association(PCMCIA), and/or the like.

Storage interfaces may accept, communicate, and/or connect to a numberof storage devices such as, but not limited to: storage devices,removable disc devices, and/or the like. Storage interfaces may employconnection protocols such as, but not limited to: (Ultra) (Serial)Advanced Technology Attachment (Packet Interface) ((Ultra) (Serial)ATA(PI)), (Enhanced) Integrated Drive Electronics ((E)IDE), Institute ofElectrical and Electronics Engineers (IEEE) 1394, fiber channel, SmallComputer Systems Interface (SCSI), Universal Serial Bus (USB), and/orthe like.

Network interfaces may accept, communicate, and/or connect to acommunications network. Through a communications network, the controllerof the present invention is accessible through remote clients (e.g.,computers with web browsers) by users. Network interfaces may employconnection protocols such as, but not limited to: direct connect,Ethernet (thick, thin, twisted pair 10/100/1000 Base T, and/or thelike), Token Ring, wireless connection such as IEEE 802.11a-x, and/orthe like. Should processing requirements dictate a greater amount speedand/or capacity, distributed network controllers (e.g., Distributedembodiments of the present invention), architectures may similarly beemployed to pool, load balance, and/or otherwise increase thecommunicative bandwidth required by the controller of the presentinvention. A communications network may be any one and/or thecombination of the following: a direct interconnection; the Internet; aLocal Area Network (LAN); a Metropolitan Area Network (MAN); anOperating Missions as Nodes on the Internet (OMNI); a secured customconnection; a Wide Area Network (WAN); a wireless network (e.g.,employing protocols such as, but not limited to a Wireless ApplicationProtocol (WAP), I-mode, and/or the like); and/or the like. A networkinterface may be regarded as a specialized form of an input outputinterface. Further, multiple network interfaces may be used to engagewith various communications network types. For example, multiple networkinterfaces may be employed to allow for the communication overbroadcast, multicast, and/or unicast networks.

Input Output interfaces (I/O) may accept, communicate, and/or connect touser input devices, peripheral devices, cryptographic processor devices,and/or the like. I/O may employ connection protocols such as, but notlimited to: audio: analog, digital, monaural, RCA, stereo, and/or thelike; data: Apple Desktop Bus (ADB), IEEE 1394a-b, serial, universalserial bus (USB); infrared; joystick; keyboard; midi; optical; PC AT;PS/2; parallel; radio; video interface: Apple Desktop Connector (ADC),BNC, coaxial, component, composite, digital, Digital Visual Interface(DVI), high-definition multimedia interface (HDMI), RCA, RF antennae,S-Video, VGA, and/or the like; wireless transceivers: 802.11a/b/g/n/x;Bluetooth; cellular (e.g., code division multiple access (CDMA), highspeed packet access (HSPA(+)), high-speed downlink packet access(HSDPA), global system for mobile communications (GSM), long termevolution (LTE), WiMax, etc.); and/or the like. One typical outputdevice may include a video display, which typically comprises a CathodeRay Tube (CRT) or Liquid Crystal Display (LCD) based monitor with aninterface (e.g., DVI circuitry and cable) that accepts signals from avideo interface, may be used. The video interface composites informationgenerated by a computer systemization and generates video signals basedon the composited information in a video memory frame. Another outputdevice is a television set, which accepts signals from a videointerface. Typically, the video interface provides the composited videoinformation through a video connection interface that accepts a videodisplay interface (e.g., an RCA composite video connector accepting anRCA composite video cable; a DVI connector accepting a DVI displaycable, etc.).

User input devices often are a type of peripheral device (see below) andmay include: card readers, dongles, finger print readers, gloves,graphics tablets, joysticks, keyboards, microphones, mouse (mice),remote controls, retina readers, touch screens (e.g., capacitive,resistive, etc.), trackballs, trackpads, sensors (e.g., accelerometers,ambient light, GPS, gyroscopes, proximity, etc.), styluses, and/or thelike.

Peripheral devices and the like may be connected and/or communicate toI/O and/or other facilities or the like such as network interfaces,storage interfaces, directly to the interface bus, system bus, the CPU,and/or the like. Peripheral devices may be external, internal and/orpart of the controller of the present invention. Peripheral devices mayalso include, for example, an antenna, audio devices (e.g., line-in,line-out, microphone input, speakers, etc.), cameras (e.g., still,video, webcam, etc.), and/or the like.

Cryptographic units such as, but not limited to, microcontrollers,processors, interfaces, and/or devices may be attached, and/orcommunicate with the controller of the present invention. A MC68HC16microcontroller, manufactured by Motorola Inc., may be used for and/orwithin cryptographic units. The MC68HC16 microcontroller utilizes a16-bit multiply-and-accumulate instruction in the 16 MHz configurationand requires less than one second to perform a 512-bit RSA private keyoperation. Cryptographic units support the authentication ofcommunications from interacting agents, as well as allowing foranonymous transactions. Cryptographic units may also be configured aspart of CPU. Equivalent microcontrollers and/or processors may also beused. Other commercially available specialized cryptographic processorsinclude: the Broadcom's CryptoNetX and other Security Processors;nCipher's nShield, SafeNet's Luna PCI (e.g., 7100) series; SemaphoreCommunications' 40 MHz Roadrunner 184; Sun's Cryptographic Accelerators(e.g., Accelerator 6000 PCIe Board, Accelerator 500 Daughtercard); ViaNano Processor (e.g., L2100, L2200, U2400) line, which is capable ofperforming 500+MB/s of cryptographic instructions; VLSI Technology's 33MHz 6868; and/or the like.

Memory

Generally, any mechanization and/or embodiment allowing a processor toaffect the storage and/or retrieval of information is regarded asmemory. However, memory is a fungible technology and resource, thus, anynumber of memory embodiments may be employed in lieu of or in concertwith one another. It is to be understood that the controller of thepresent invention and/or a computer systemization may employ variousforms of memory. For example, a computer systemization may be configuredwherein the functionality of on-chip CPU memory (e.g., registers), RAM,ROM, and any other storage devices are provided by a paper punch tape orpaper punch card mechanism; of course such an embodiment would result inan extremely slow rate of operation. In a typical configuration, memorywill include ROM, RAM, and a storage device. A storage device may be anyconventional computer system storage. Storage devices may include adrum; a (fixed and/or removable) magnetic disk drive; a magneto-opticaldrive; an optical drive (i.e., Blueray, CD ROM/RAM/Recordable(R)/ReWritable (RW), DVD R/RW, HD DVD R/RW etc.); an array of devices(e.g., Redundant Array of Independent Disks (RAID)); solid state memorydevices (USB memory, solid state drives (SSD), etc.); otherprocessor-readable storage mediums; and/or other devices of the like.Thus, a computer systemization generally requires and makes use ofmemory.

Component Collection

The memory may contain a collection of program and/or databasecomponents and/or data such as, but not limited to: operating systemcomponent(s) (operating system); information server component(s)(information server); user interface component(s) (user interface); Webbrowser component(s) (Web browser); database(s); mail servercomponent(s); mail client component(s); cryptographic servercomponent(s) (cryptographic server) and/or the like (i.e., collectivelya component collection). These components may be stored and accessedfrom the storage devices and/or from storage devices accessible throughan interface bus. Although non-conventional program components such asthose in the component collection, typically, are stored in a localstorage device, they may also be loaded and/or stored in memory such as:peripheral devices, RAM, remote storage facilities through acommunications network, ROM, various forms of memory, and/or the like.

Operating System

The operating system component is an executable program componentfacilitating the operation of the controller of the present invention.Typically, the operating system facilitates access of I/O, networkinterfaces, peripheral devices, storage devices, and/or the like. Theoperating system may be a highly fault tolerant, scalable, and securesystem such as: Apple Macintosh OS X (Server); AT&T Plan 9; Be OS; Unixand Unix-like system distributions (such as AT&T's UNIX; BerkleySoftware Distribution (BSD) variations such as FreeBSD, NetBSD, OpenBSD,and/or the like; Linux distributions such as Red Hat, Ubuntu, and/or thelike); and/or the like operating systems. However, more limited and/orless secure operating systems also may be employed such as AppleMacintosh OS, IBM OS/2, Microsoft DOS, Microsoft Windows2000/2003/3.1/95/98/CE/Millennium/NT/Vista/XP (Server), Palm OS, and/orthe like. The operating system may be one specifically optimized to berun on a mobile computing device, such as iOS, Android, Windows Phone,Tizen, Symbian, and/or the like. An operating system may communicate toand/or with other components in a component collection, includingitself, and/or the like. Most frequently, the operating systemcommunicates with other program components, user interfaces, and/or thelike. For example, the operating system may contain, communicate,generate, obtain, and/or provide program component, system, user, and/ordata communications, requests, and/or responses. The operating system,once executed by the CPU, may enable the interaction with communicationsnetworks, data, I/O, peripheral devices, program components, memory,user input devices, and/or the like. The operating system may providecommunications protocols that allow the controller of the presentinvention to communicate with other entities through a communicationsnetwork. Various communication protocols may be used by the controllerof the present invention as a subcarrier transport mechanism forinteraction, such as, but not limited to: multicast, TCP/IP, UDP,unicast, and/or the like.

Information Server

An information server component is a stored program component that isexecuted by a CPU. The information server may be a conventional Internetinformation server such as, but not limited to Apache SoftwareFoundation's Apache, Microsoft's Internet Information Server, and/or thelike. The information server may allow for the execution of programcomponents through facilities such as Active Server Page (ASP), ActiveX,(ANSI) (Objective-) C (++), C# and/or .NET, Common Gateway Interface(CGI) scripts, dynamic (D) hypertext markup language (HTML), FLASH,Java, JavaScript, Practical Extraction Report Language (PERL), HypertextPre-Processor (PHP), pipes, Python, wireless application protocol (WAP),WebObjects, and/or the like. The information server may support securecommunications protocols such as, but not limited to, File TransferProtocol (FTP); HyperText Transfer Protocol (HTTP); Secure HypertextTransfer Protocol (HTTPS), Secure Socket Layer (SSL), messagingprotocols (e.g., America Online (AOL) Instant Messenger (AIM),Application Exchange (APEX), ICQ, Internet Relay Chat (IRC), MicrosoftNetwork (MSN) Messenger Service, Presence and Instant Messaging Protocol(PRIM), Internet Engineering Task Force's (IETF's) Session InitiationProtocol (SIP), SIP for Instant Messaging and Presence LeveragingExtensions (SIMPLE), open XML-based Extensible Messaging and PresenceProtocol (XMPP) (i.e., Jabber or Open Mobile Alliance's (OMA's) InstantMessaging and Presence Service (IMPS)), Yahoo! Instant MessengerService, and/or the like. The information server provides results in theform of Web pages to Web browsers, and allows for the manipulatedgeneration of the Web pages through interaction with other programcomponents. After a Domain Name System (DNS) resolution portion of anHTTP request is resolved to a particular information server, theinformation server resolves requests for information at specifiedlocations on the controller of the present invention based on theremainder of the HTTP request. For example, a request such ashttp://123.124.125.126/myInformation.html might have the IP portion ofthe request “123.124.125.126” resolved by a DNS server to an informationserver at that IP address; that information server might in turn furtherparse the http request for the “/myInformation.html” portion of therequest and resolve it to a location in memory containing theinformation “myInformation.html.” Additionally, other informationserving protocols may be employed across various ports, e.g., FTPcommunications across port, and/or the like. An information server maycommunicate to and/or with other components in a component collection,including itself, and/or facilities of the like. Most frequently, theinformation server communicates with the database of the presentinvention, operating systems, other program components, user interfaces,Web browsers, and/or the like.

Access to the database of the present invention may be achieved througha number of database bridge mechanisms such as through scriptinglanguages as enumerated below (e.g., CGI) and through inter-applicationcommunication channels as enumerated below (e.g., CORBA, WebObjects,etc.). Any data requests through a Web browser are parsed through thebridge mechanism into appropriate grammars as required by the presentinvention. In one embodiment, the information server would provide a Webform accessible by a Web browser. Entries made into supplied fields inthe Web form are tagged as having been entered into the particularfields, and parsed as such. The entered terms are then passed along withthe field tags, which act to instruct the parser to generate queriesdirected to appropriate tables and/or fields. In one embodiment, theparser may generate queries in standard SQL by instantiating a searchstring with the proper join/select commands based on the tagged textentries, wherein the resulting command is provided over the bridgemechanism to the present invention as a query. Upon generating queryresults from the query, the results are passed over the bridgemechanism, and may be parsed for formatting and generation of a newresults Web page by the bridge mechanism. Such a new results Web page isthen provided to the information server, which may supply it to therequesting Web browser.

Also, an information server may contain, communicate, generate, obtain,and/or provide program component, system, user, and/or datacommunications, requests, and/or responses.

User Interface

Computer interfaces in some respects are similar to automobile operationinterfaces. Automobile operation interface elements such as steeringwheels, gearshifts, and speedometers facilitate the access, operation,and display of automobile resources, and status. Computer interactioninterface elements such as check boxes, cursors, menus, scrollers, andwindows (collectively and commonly referred to as widgets) similarlyfacilitate the access, capabilities, operation, and display of data andcomputer hardware and operating system resources, and status. Operationinterfaces are commonly called user interfaces. Graphical userinterfaces (GUIs) such as the Apple Macintosh Operating System's Aqua,IBM's OS/2, Microsoft's Windows2000/2003/3.1/95/98/CE/Millennium/NT/XP/Vista/7 (i.e., Aero), Unix'sX-Windows (e.g., which may include additional Unix graphic interfacelibraries and layers such as K Desktop Environment (KDE), mythTV and GNUNetwork Object Model Environment (GNOME)), web interface libraries(e.g., ActiveX, AJAX, (D)HTML, FLASH, Java, JavaScript, etc. interfacelibraries such as, but not limited to, Dojo, jQuery(UI), MooTools,Prototype, script.aculo.us, SWFObject, Yahoo! User Interface, any ofwhich may be used and) provide a baseline and means of accessing anddisplaying information graphically to users.

A user interface component is a stored program component that isexecuted by a CPU. The user interface may be a conventional graphic userinterface as provided by, with, and/or atop operating systems and/oroperating environments such as already discussed. The user interface mayallow for the display, execution, interaction, manipulation, and/oroperation of program components and/or system facilities through textualand/or graphical facilities. The user interface provides a facilitythrough which users may affect, interact, and/or operate a computersystem. A user interface may communicate to and/or with other componentsin a component collection, including itself, and/or facilities of thelike. Most frequently, the user interface communicates with operatingsystems, other program components, and/or the like. The user interfacemay contain, communicate, generate, obtain, and/or provide programcomponent, system, user, and/or data communications, requests, and/orresponses.

Web Browser

A Web browser component is a stored program component that is executedby a CPU. The Web browser may be a conventional hypertext viewingapplication such as Microsoft Internet Explorer or Netscape Navigator.Secure Web browsing may be supplied with 128 bit (or greater) encryptionby way of HTTPS, SSL, and/or the like. Web browsers allowing for theexecution of program components through facilities such as ActiveX,AJAX, (D)HTML, FLASH, Java, JavaScript, web browser plug-in APIs (e.g.,FireFox, Safari Plug-in, and/or the like APIs), and/or the like. Webbrowsers and like information access tools may be integrated into PDAs,cellular telephones, and/or other mobile devices. A Web browser maycommunicate to and/or with other components in a component collection,including itself, and/or facilities of the like. Most frequently, theWeb browser communicates with information servers, operating systems,integrated program components (e.g., plug-ins), and/or the like; e.g.,it may contain, communicate, generate, obtain, and/or provide programcomponent, system, user, and/or data communications, requests, and/orresponses. Of course, in place of a Web browser and information server,a combined application may be developed to perform similar functions ofboth. The combined application would similarly affect the obtaining andthe provision of information to users, User Agents, and/or the like fromthe enabled nodes of the present invention. The combined application maybe nugatory on systems employing standard Web browsers.

Mail Server

A mail server component is a stored program component that is executedby a CPU. The mail server may be a conventional Internet mail serversuch as, but not limited to sendmail, Microsoft Exchange, and/or thelike. The mail server may allow for the execution of program componentsthrough facilities such as ASP, ActiveX, (ANSI) (Objective-) C (++), C#and/or .NET, CGI scripts, Java, JavaScript, PERL, PHP, pipes, Python,WebObjects, and/or the like. The mail server may support communicationsprotocols such as, but not limited to: Internet message access protocol(IMAP), Messaging Application Programming Interface (MAPI)/MicrosoftExchange, post office protocol (POP3), simple mail transfer protocol(SMTP), and/or the like. The mail server can route, forward, and processincoming and outgoing mail messages that have been sent, relayed and/orotherwise traversing through and/or to the present invention.

Access to the mail of the present invention may be achieved through anumber of APIs offered by the individual Web server components and/orthe operating system.

Also, a mail server may contain, communicate, generate, obtain, and/orprovide program component, system, user, and/or data communications,requests, information, and/or responses.

Mail Client

A mail client component is a stored program component that is executedby a CPU. The mail client may be a conventional mail viewing applicationsuch as Apple Mail, Microsoft Entourage, Microsoft Outlook, MicrosoftOutlook Express, Mozilla, Thunderbird, and/or the like. Mail clients maysupport a number of transfer protocols, such as: IMAP, MicrosoftExchange, POP3, SMTP, and/or the like. A mail client may communicate toand/or with other components in a component collection, includingitself, and/or facilities of the like. Most frequently, the mail clientcommunicates with mail servers, operating systems, other mail clients,and/or the like; e.g., it may contain, communicate, generate, obtain,and/or provide program component, system, user, and/or datacommunications, requests, information, and/or responses. Generally, themail client provides a facility to compose and transmit electronic mailmessages.

Cryptographic Server

A cryptographic server component is a stored program component that isexecuted by a CPU, cryptographic processor, cryptographic processorinterface, cryptographic processor device, and/or the like.Cryptographic processor interfaces will allow for expedition ofencryption and/or decryption requests by the cryptographic component;however, the cryptographic component, alternatively, may run on aconventional CPU. The cryptographic component allows for the encryptionand/or decryption of provided data. The cryptographic component allowsfor both symmetric and asymmetric (e.g., Pretty Good Protection (PGP))encryption and/or decryption. The cryptographic component may employcryptographic techniques such as, but not limited to: digitalcertificates (e.g., X.509 authentication framework), Digital Signatures,dual signatures, enveloping, password access protection, public keymanagement, and/or the like. The cryptographic component will facilitatenumerous (encryption and/or decryption) security protocols such as, butnot limited to: checksum, Data Encryption Standard (DES), EllipticalCurve Encryption (ECC), International Data Encryption Algorithm (IDEA),Message Digest 5 (MD5, which is a one way hash function), passwords,Rivest Cipher (RC5), Rijndael, RSA (which is an Internet encryption andauthentication system that uses an algorithm developed in 1977 by RonRivest, Adi Shamir, and Leonard Adleman), Secure Hash Algorithm (SHA),Secure Socket Layer (SSL), Secure Hypertext Transfer Protocol (HTTPS),and/or the like. Employing such encryption security protocols, thepresent invention may encrypt all incoming and/or outgoingcommunications and may serve as node within a virtual private network(VPN) with a wider communications network. The cryptographic componentfacilitates the process of “security authorization” whereby access to aresource is inhibited by a security protocol wherein the cryptographiccomponent effects authorized access to the secured resource. Inaddition, the cryptographic component may provide unique identifiers ofcontent, e.g., employing and MD5 hash to obtain a unique signature foran digital audio file. A cryptographic component may communicate toand/or with other components in a component collection, includingitself, and/or facilities of the like. The cryptographic componentsupports encryption schemes allowing for the secure transmission ofinformation across a communications network to enable the component ofthe present invention to engage in secure transactions if so desired.The cryptographic component facilitates the secure accessing ofresources on the present invention and facilitates the access of securedresources on remote systems; i.e., it may act as a client and/or serverof secured resources. Most frequently, the cryptographic componentcommunicates with information servers, operating systems, other programcomponents, and/or the like. The cryptographic component may contain,communicate, generate, obtain, and/or provide program component, system,user, and/or data communications, requests, and/or responses.

The Database of the Present Invention

The database component of the present invention may be embodied in adatabase and its stored data. The database is a stored programcomponent, which is executed by the CPU; the stored program componentportion configuring the CPU to process the stored data. The database maybe a conventional, fault tolerant, relational, scalable, secure databasesuch as Oracle or Sybase. Relational databases are an extension of aflat file. Relational databases consist of a series of related tables.The tables are interconnected via a key field. Use of the key fieldallows the combination of the tables by indexing against the key field;i.e., the key fields act as dimensional pivot points for combininginformation from various tables. Relationships generally identify linksmaintained between tables by matching primary keys. Primary keysrepresent fields that uniquely identify the rows of a table in arelational database. More precisely, they uniquely identify rows of atable on the “one” side of a one-to-many relationship.

Alternatively, the database of the present invention may be implementedusing various standard data-structures, such as an array, hash, (linked)list, struct, structured text file (e.g., XML), table, JSON, NOSQLand/or the like. Such data-structures may be stored in memory and/or in(structured) files. In another alternative, an object-oriented databasemay be used, such as Frontier, ObjectStore, Poet, Zope, and/or the like.Object databases can include a number of object collections that aregrouped and/or linked together by common attributes; they may be relatedto other object collections by some common attributes. Object-orienteddatabases perform similarly to relational databases with the exceptionthat objects are not just pieces of data but may have other types offunctionality encapsulated within a given object. If the database of thepresent invention is implemented as a data-structure, the use of thedatabase of the present invention may be integrated into anothercomponent such as the component of the present invention. Also, thedatabase may be implemented as a mix of data structures, objects, andrelational structures. Databases may be consolidated and/or distributedin countless variations through standard data processing techniques.Portions of databases, e.g., tables, may be exported and/or imported andthus decentralized and/or integrated.

In one embodiment, the database component includes several tables. Auser table may include fields such as, but not limited to: user_id, ssn,dob, first_name, last_name, age, state, address_firstline,address_secondline, zipcode, devices_list, contact_info, contact_type,alt_contact_info, alt_contact_type, DID, and/or the like to refer to anytype of enterable data or selections discussed herein. The user's tablemay support and/or track multiple Entity accounts. A Client's table mayinclude fields such as, but not limited to: user_id, client_id,client_ip, client_type, client_model, operating_system, os_version,app_installed_flag, and/or the like. An Apps table may include fieldssuch as, but not limited to: app_ID, app_name, app_type,OS_compatibilities_list, version, timestamp, developer_ID, and/or thelike.

In one embodiment, user programs may contain various user interfaceprimitives, which may serve to update the platform of the presentinvention. Also, various accounts may require custom database tablesdepending upon the environments and the types of clients the system ofthe present invention may need to serve. It should be noted that anyunique fields may be designated as a key field throughout. In analternative embodiment, these tables have been decentralized into theirown databases and their respective database controllers (i.e.,individual database controllers for each of the above tables). Employingstandard data processing techniques, one may further distribute thedatabases over several computer systemizations and/or storage devices.Similarly, configurations of the decentralized database controllers maybe varied by consolidating and/or distributing the various databasecomponents. The system of the present invention may be configured tokeep track of various settings, inputs, and parameters via databasecontrollers.

Definitions

Certain terms are used throughout this document and are defined asfollows:

Term Description Assertion The data record or file representing theDigital Credential in JSON or JSON-LD format. ComposabilityComposability is a system design principle that deals with the inter-relationships of components. A highly composable system providesrecombinant components that can be selected and assembled in variouscombinations to satisfy specific user requirements. In informationsystems, the essential features that make a component composable arethat it is self- contained and stateless. Claim A statement made by oneor more entities about a specific Entity. Creator The thing that createdthe resource. For example, the key that created a Digital Signature.Credential A qualification, achievement, personal quality, aspect of anEntity's background such as a name, government ID, payment processor,home address, or university degree, or verifiable statement by an Entityabout another Entity. Credentials may be stored in Identity Documents.Credential Software that behaves like an IdP and uses the CTP, however,is not Aggregator actually a chosen IdP for any Credential Recipients;rather it is a storage (“Vault”) area for Issuers to send Credentialsfor later pick up by the Recipient regardless of their IdP of choice.Credential An Entity that requests a Credential for processing. ConsumerCredential An application that can request Credentials using the CTP.How the Consumer Tool application consumes a Credential once it has beenretrieved is an implementation detail. Recipient Credential Atransmission of a Credential from one Entity to another Entity. ExchangeCredential Software responsible for creating new Credentials for aparticular Identity. Processor Tool It uses the CTP to transmitCredentials to an IdP. Credential Service A program, such as aCredential storage vault or personal Credential “wallet” that stores andprotects access to a Recipient's Credentials. Credentials A set ofmessages and protocols for issuing, storing, requesting, and TransportProtocol transmitting Credentials. (CTP) Credential CredentialCertification is about proving the Claims made are actually true.Certification This would like employ probing various attributesincluding, but not limited to: public key ownership, Entity Identityverification and Credential Verification. Credential The process thatdemonstrates the information in a Credential is well- Validation formed.Credential The process that cryptographically demonstrates theauthenticity of a Verification Credential. Decentralized A portableURI-based identifier, also known as a DID, that is associated Identifier(DID) with an entity. These identifiers are most often used in acredential and are associated with recipients such that the credentialitself can be easily ported from one identity provider to anotherwithout the need to reissue the credential. An example of a DID is:did:b6922d8e-20df-4939-95cd- f79375979178 Digital Credential A DigitalCredential is an electronic document that 1) contains machine- readabledata, 2) expresses Claims made by one person or organization aboutanother, and 3) is cryptographically verifiable. Digital Signature Amathematical scheme for demonstrating the authenticity of a digital (akaSignature) message. Entity A thing with distinct and independentexistence such as an individual person, organization, or instance of asoftware program. Identity A set of information that can be used toidentify a particular Entity such as a person, software agent, ororganization. An Entity may have multiple identities associated with it.Identity Document A Web-based document that contains statements about aparticular Identity. Identity Documents must be accessible in JSON-LDformat and may be accessible in other RDF-compatible formats. IdentityDocument An Identity Document URL consists of an HTTP or HTTPS schemeand URL denotes an Identity. For example:https://example.org/identities/manu. Identity Owner An Entity that is incontrol of a particular Identity Document. Identity Provider A websiteproviding access to one or more Identity Documents. - An IdP is (IdP)responsible for managing an Entity's Identity (an Entity is usually aperson). It must handle requests to associate newly issued Credentialswith an Identity and to retrieve Credentials that have already beenassociated. It uses the CTP to handle these tasks. How an IdP associatesand retrieves Credentials is an implementation detail. Interdependent AnIDC is made of up of one or more Digital Credentials that are linkedCredential together (Linked Data) using JSON or other format. Collection(IDC) Issuer The authoritative Entity responsible for data contained andoptionally digitally signed in a Credential. JSON/JSON-LD JSON isintended to mean a lightweight Linked Data format. It is based on thealready successful JSON format and provides a way to help JSON datainteroperate at Web-scale. JSON-LD is an ideal data format forprogramming environments, REST Web services, and unstructured databases.Linked Data empowers people that publish and use information on the Web.It is a way to create a network of standards-based, machine- readabledata across Web sites. Linked Data Linked data is intended to refer to aset of best practices for publishing and connecting structured data onthe Web. Key technologies that support Linked Data are URIs (a genericmeans to identify entities or concepts in the world), HTTP (a simple yetuniversal mechanism for retrieving resources, or descriptions ofresources), and RDF (a generic graph-based data model with which tostructure and link data that describes things in the world). Linked datais about using the Web to connect related data that wasn't previouslylinked, or using the Web to lower the barriers to linking data currentlylinked using other methods. More specifically, Wikipedia defines LinkedData as “a term used to describe a recommended best practice forexposing, sharing, and connecting pieces of data, information, andknowledge on the Semantic Web using URIs and RDF.” Resource RDF is oneof the key ingredients of Linked Data, and provides a genericDescription graph-based data model for describing things, includingtheir relationships Framework with other things. RDF data can be writtendown in a number of different (“RDF”) ways, known as serializations.Examples of RDF serializations include RDF/XML, Notation-3 (N3), Turtle,N-Triples, RDFa, and RDF/JSON. Recipient An Entity that is in control ofa particular Credential. Typically a Recipient is also the primary topicof the information in a Credential and is the Entity that initiates thetransmission of the Credential. Examples: college Recipient, plumber,CPA, job trainee, competitive fisherman, golfer, publisher, commercialdriver, insurance policy owner, or the like. User Agent A program, suchas a browser or other Web client that mediates the communication betweenRecipients, Issuers and Credential Consumers. Uniform Resource Incomputing, a Uniform Resource Identifier (URI) is a string of charactersIdentifier (URI) used to identify a name of a resource. Suchidentification enables interaction with representations of the resourceover a network, typically the World Wide Web, using specific protocols.WebDHT A mechanism that is used to discover the software services, suchas an Identity Provider, associated with an Entity. Technicallyspeaking, it is a Web-based decentralized hash-table built on Webarchitecture principles that is used to map cryptographic hashes todecentralized identifiers and decentralized identifiers to decentralizedidentifier documents. The technology is used to map cryptographic hashesof email addresses and passphrases to decentralized identifier documentswhich can then be used to discover an Entity's Identity Provider. Thetechnology is one way of solving the NASCAR service bootstrap problem.

The present invention comprises a system and methods for interdependentIdentity based Credential collection validation. The system is comprisedof a number of different components, potentially operated by differentproviders. In one embodiment, the system is partially comprised of aCredential Aggregator. Issuers may use a 3^(rd)-party CredentialAggregator, which acts as a centralized storage system for issuedDigital Credentials. This Credential Aggregator will interface with theIssuers of various Credentials. In some embodiments, the CredentialAggregator will provide the organization of a number of predeterminedCredentials represented as an IDC. A Credential Consumer will evaluate agiven IDC, verifying that each Digital Credential contained in the IDCis valid. If just one of the Credentials in the IDC is invalid, theCredential Consumer would consider the IDC to be invalid.

For example, a person may want to certify that she is a validly licensedpatent attorney. To prove this, she will have to prove: (1) hertechnical background, (2) her graduation from a law school, (3) that shehas passed the bar examination in at least one state, (4) that she haspassed the patent bar examination, (5) that she is a member in goodstanding with the State in which she is licensed to practice law, and(6) that she is in good standing with the United States Patent andTrademark Office. Thus, a person who wishes to have her status as apatent attorney verified by a Credential Consumer will have to get 6Credentials from the Credentials Aggregator. Under the presentinvention, this person would have to receive a Digital Credential fromeach respective authoritative Issuer representing each of the 6requirements.

Here, these Credentials would be sent by a number of Issuers; the StateBoard of Bar Examiners would be able to provide the Digital Credentialsregarding the license to practice law in that given state, as well aswhether that person was still a member in good standing; the UnitedStates Patent and Trademark Office would provide the Digital Credentialsthat the person has passed the appropriate examination and is still amember in good standing and potentially proof of the person's technicalbackground as well. However, the Digital Credentials showing thisperson's technical background is preferably provided by the institutionthat provided the individual's technical education. In this example,this institution qualifies as a Primary Source Provider. Also, the lawschool that the person attended would preferably provide the DigitalCredential that the person received a law degree from that law school,but the State Board of Bar Examiners would also be able to provide thisDigital Credential.

For illustrative purposes only, the system where the preferredembodiment of the present invention would be executed would offer thefollowing scenario for a nurse practitioner (the Recipient in thisillustration): The nurse practitioner has just been notified by thestate licensing board that her nursing license has been issued to nursepractitioner's DID, represented as a Digital Credential. The nursepractitioner logs into her IdP, such as TrueCred™ Folio, to claim theirnursing license Digital Credential. The same procedure repeats for thenurse practitioner's malpractice insurance provider, background checkprovider and the drug prescription licensing board, all of which issueseparate Digital Credentials. All four (4) Credentials are requiredClaims for nurse practitioner to be in compliance. The IdP provides themeans for the Recipient to share her claimed Digital Credentials withCredential Consumers, such as a hospital's compliance officer. Each ofthe nurse's Digital Credential's meta-data may be independently verifiedby the Credential Consumer. This typically includes verifying theIssuer, Recipient, and Claims (i.e., short-title, description, criteria,expiration date).

The present invention provides the mean to assemble one or more DigitalCredentials into an IDC. Each IDC is represented by a Uniform ResourceIdentifier (URI). The IDC's URI is supplied to an IDC Credentialverifier, which determines the status of the IDC, which is valid orinvalid.

The system of the present invention will provide a number of benefits toa user. In a preferred embodiment, entities will be able to form IDCs asspecialized Assertions, which allows for simultaneous verification of aset of Digital Credentials. The IDC Assertions are digitally signed toensure that they cannot be tampered with. The IDC Assertion must beallowed to be verifiable via an independent 3^(rd) party. Further, thesystem of the present invention will be able to add its own arbitrarydata to the Assertion and digitally counter-sign the Issuer's Assertion.In another embodiment an IDC Credential verifier will be able to performqueries on the system of the present invention over the Web usingcurrent best practices and common protocols. In a preferred embodiment,the system of the present invention can be scaled to a myriad ofIssuers, Recipients, and requests per second

In various embodiments, security can be achieved from Public/Private KeyCryptography, a decentralized technology that enables encryption andDigital Signatures to be applied to data. Digital Signatures aredesigned to be independently verifiable by 3^(rd) parties using softwarebased on open standards.

In yet another embodiment, the system and method of the presentinvention will provide for: an Issuer. Recipient or Consumer being ableto sign up for the purposes of creating or managing IDCs;

The system of the present invention implements as software-as-a-service(SaaS). The SaaS of the present invention validates Digital Credentialsin five steps; (1) meta-data associated with a Credential is linked toan DID; (2) This Credential's Assertion is formatted as JSON-LD; (3) theAssertion is signed with a private key; (4) the signed DigitalCredential is curated with an IdP; and (5) the Credential meta-data isverified with a public key. All of this functionality is packaged intoan API that will be made widely available. In another embodiment theAssertion may be formatted in BSON, TOML, YAML or another datainterchange format.

In a preferred embodiment, the present invention is capable of verifyingsuper sets, known as an IDC. That is, there may exist Credential setsthat are comprised of another Credentials set, plus at least oneadditional Credential. In this situation, the present invention mayvalidate and verify all Credentials individually, or may use theverification of the subset as satisfaction of the Credentials containedtherein.

In alternative embodiments, entities may endorse (“counter-sign”)preexisting Credential sets as satisfying some standard of their own.For example, suppose State A and State B have the same Credentialsrequirements for driving in either state. State A has already created aCredentials set within the system of the present invention. Accordingly,State B may counter-sign this preexisting IDC and allow State A'slicensed vehicle operators to have a verified IDC allowing them to drivewithin State B.

In some embodiments of the present invention, an IDC may not be modifiedwithout compromising the validation of the set. In other embodiments, anIDC may be modified without compromising the verification of the set.

FIG. 1 shows a decision tree of the method of an embodiment of thepresent invention. As shown here, the interdependencies of the DigitalCredentials become highlighted. In this example the method of thepresent invention is attempting to parse a Recipient's Credentials todetermine whether he may validly drive a car. Here, the ability to drivea car (legally) is the IDC (“set”), comprised of Digital Credentials ofwhether the Recipient has a valid driver's license, and whether theRecipient has a compliant insurance policy with the state upon which hebases his legal right to drive. Digital Credential 101 shows theRecipient's insurance, and Digital Credential 102 shows the Recipient'sdriver's license. Here, the Recipient's insurance is not valid, so themethod returns an invalid status and the set is not fulfilled.

FIG. 2 shows a flow chart illustrating an embodiment of the method ofthe present invention. In step 201, at least one Digital Credential isprovided. Here, a Digital Credential is comprised of at least one itemof legitimate information, and at least one status identifier. In apreferred embodiment, this at least one item of legitimate informationis provided by a Primary Source Provider, however, in alternativeembodiments this information can be provided by an Issuer. By legitimateit is intended to mean that the item of information is a true andaccurate representation of what it is intended to represent. The statusidentifier is used to instruct the system as to whether the DigitalCredential may be used to satisfy an IDC. In step 202, an IDC isdefined. Preferably this IDC will be comprised of at least one DigitalCredential, although it may be comprised of a second Credentials set andat least one additional Digital Credential. It should be noted that theCredential set itself has its own status identifier indicating whetherthe IDC is ready to be verified. In step 203, the format of the at leastone Digital Credential that was provided is validated. This is to ensurethat the Digital Credential is in a format that may be accessed by thepresent invention. In step 204, the present invention determines whetherthe provided Digital Credential(s) are ready to fulfill a parameter ofthe IDC; that is, whether the Digital Credential is still good in theeyes of the Issuer and/or Primary Source Provider. If the DigitalCredential is still good, then its status identifier is changedaccordingly in step 205. In step 206, the IDC is verified if all of itscomponent Digital Credentials have their status identifiers set suchthat the IDC status identifier is satisfied. Upon the successfulcompletion of step 206, the method proceeds to step 207 where thepresent invention digitally signs the verified IDC. In anotherembodiment of the present invention, the verified Credential set doesnot have to be digitally signed (Step 207).

In another embodiment, the present invention may be used on orfacilitated through various devices such as laptops, tablets orsmartphones. In this embodiment, such devices may be configured totransmit or broadcast a signal, via Bluetooth Low Energy or similarwireless personal area network technology, of an Entity's location,proximity to a location and the Entity's credential status as validatedor verified. Accordingly, the present invention would enable the deviceto act as a beacon or transponder such that the correct Entity using thedevice may be securely located and tracked. In this alternativeembodiment, an Entity's identification and credentials may be confirmedthrough their device and thus allowed access to a specific location. Forexample, a hospital may utilize this embodiment when allowing access totheir facility. A hospital may be able to track the movement of anindividual through their device but also have credential confirmationthat the individual is who they are purporting to be. In yet anotherembodiment of the present invention, the identification and credentialsof an airplane or shipping vehicle may be tracked and confirmed in theair, in route or at all times.

Although this invention has been described with a certain degree ofparticularity, it is to be understood that the present disclosure hasbeen made only by way of illustration and that numerous changes in thedetails of construction and arrangement of parts may be resorted towithout departing from the spirit and the scope of the invention.

Various other components may be included and called upon for providingfor aspects of the teachings herein. For example, additional materials,combinations of materials and/or omission of materials may be used toprovide for added embodiments that are within the scope of the teachingsherein. In the present application a variety of variables are described,including but not limited to components and conditions. It is to beunderstood that any combination of any of these variables can define anembodiment of the disclosure. Other combinations of articles,components, conditions, and/or methods can also be specifically selectedfrom among variables listed herein to define other embodiments, as wouldbe apparent to those of ordinary skill in the art.

When introducing elements of the present disclosure or the embodiment(s)thereof, the articles “a,” “an,” and “the” are intended to mean thatthere are one or more of the elements. Similarly, the adjective“another,” when used to introduce an element, is intended to mean one ormore elements. The terms “including” and “having” are intended to beinclusive such that there may be additional elements other than thelisted elements.

While the disclosure refers to exemplary embodiments, it will beunderstood by those skilled in the art that various changes may be madeand equivalents may be substituted for elements thereof withoutdeparting from the scope of the disclosure. In addition, manymodifications will be appreciated by those skilled in the art to adapt aparticular instrument, situation or material to the teachings of thedisclosure without departing from the spirit thereof. Therefore, it isintended that the disclosure not be limited to the particularembodiments disclosed.

What is claimed is:
 1. A system for verifying and digitally signing aninterdependent credential collection, the system comprising: one or morephysical processors one or more computer memories; and a storage deviceconfigured to store one or more computer-executable instructions that,when executed by the one or more physical processors, configure the oneor more physical processors to: define a first interdependent credentialcollection comprising a first plurality of digital credentials linkedtogether in the one or more computer memories via a linked data formatand having a first interdependent credential collection statusidentifier indicating a status of the first interdependent credentialcollection, wherein if all of the first plurality of digital credentialsare validated and verified, the first interdependent credentialcollection status identifier is set to a verified state and if at leastone of the first plurality of digital credentials is not validated andverified, the first interdependent credential collection statusidentifier is set to an unverified state, wherein each individualdigital credential of the first plurality of digital credentials iscryptographically verifiable and comprises machine-readable data, atleast one item of legitimate information provided by a primary sourceprovider or issuer expressing a claim made by one person or organizationabout another, and a digital credential status identifier indicating astatus of the individual digital credential determined based on one ormore attributes associated with the individual digital credential,wherein the status identifier for an individual digital credentialindicates whether that individual digital credential may be used tosatisfy a parameter of the first interdependent credential collection;validate a format of the individual digital credentials of the firstplurality of digital credentials to confirm the individual digitalcredentials are in a format compatible with the first interdependentcredential collection; determine whether the status identifiers for eachof the individual digital credentials of the first plurality of digitalcredentials satisfy a verification parameter, the verification parametercomprising an indication from the primary source provider or issuer thatthe individual digital credential is still accurate; set the statusidentifier of each of the individual digital credentials of the firstplurality set of digital credentials that have been determined tosatisfy the verification parameter to verified; verify the firstinterdependent credential collection based on a determination that thestatus identifiers for each of the individual digital credentials of thefirst plurality set of digital credentials are set to verified, set thefirst interdependent credential collection status identifier toverified; and digitally sign the verified first interdependentcredential collection.
 2. The system of claim 1, wherein each individualdigital credential of the first plurality of digital credentials isassociated with a decentralized identifier.
 3. The system of claim 2,wherein the one or more physical processors are further configured toimplement a software-as-a-service (SaaS) for validating the individualdigital credentials of the first plurality of digital credentials,wherein to validate a first individual digital credential of the firstplurality of digital credentials, the one or more physical processorsare configured to: link metadata associated with the first individualdigital credential with the decentralized identifier; format anassertion of the first individual digital credential in JSON or JSON-LDformat, wherein the assertion of the first individual digital credentialcomprises the data record or file representing the individual digitalcredential; digitally sign the assertion of the first individual digitalcredential with a private key; and verify metadata of the firstindividual digital credential with a public key.
 4. The system of claim1, wherein the one or more physical processors are further configured toobtain one or more of the individual digital credentials of the firstplurality of digital credentials via a the primary source provider orissuer.
 5. The system of claim 1, wherein the one or more physicalprocessors are further configured to modify the first interdependentcredential collection.
 6. The system of claim 1, wherein the one or morephysical processors are further configured to receive, from an entity,an endorsement of the first interdependent credential collection.
 7. Thesystem of claim 1, wherein the at least one item of legitimateinformation is selected from the group consisting of type, issuer,claim, date issued, title, carrier, license, state, driver, birth date,address, expiration date, signature graph, public key, and identity. 8.The system of claim 1, wherein the one or more physical processors arefurther configured to: define a second interdependent credentialcollection, the second interdependent credential collection having asecond interdependent credential collection status identifier indicatinga status of the second interdependent credential collection andcomprising a second plurality of digital credentials, the secondplurality of digital credentials comprising the first plurality ofdigital credentials of the first interdependent credential collectionand at least one additional credential; and verify the secondinterdependent credential collection based on the first interdependentcredential collection status identifier and the additional credentialwithout verifying any of the individual credentials of the firstinterdependent credential collection.
 9. The system of claim 1, whereinthe one or more computer memories comprise one or more web servers. 10.A computer-implemented method of verifying and digitally signing aninterdependent credential collection, the method comprising: defining afirst interdependent credential collection comprising a first pluralityof digital credentials linked together in one or more computer memoriesvia a linked data format and having a first interdependent credentialcollection status identifier indicating a status of the firstinterdependent credential collection, wherein if all of the firstplurality of digital credentials are validated and verified, the firstinterdependent credential collection status identifier is set to averified state and if at least one of the first plurality of digitalcredentials is not validated and verified, the first interdependentcredential collection status identifier is set to an unverified state,wherein each individual digital credential of the first plurality ofdigital credentials is cryptographically verifiable and comprisesmachine-readable data, at least one item of legitimate informationprovided by a primary source provider or issuer expressing a claim madeby one person or organization about another, and a digital credentialstatus identifier indicating a status of the individual digitalcredential determined based on one or more attributes associated withthe digital credential, wherein the status identifier for an individualdigital credential indicates whether that individual digital credentialmay be used to satisfy a parameter of the first interdependentcredential collection; validating a format of the individual digitalcredentials of the first plurality of digital credentials to confirm theindividual digital credentials are in a format compatible with the firstinterdependent credential collection; determining whether the statusidentifiers for each of the individual digital credentials of the firstplurality of digital credentials satisfy a verification parameter, theverification parameter comprising an indication from the primary sourceprovider or issuer that the individual digital credential is stillaccurate; setting the status identifier of each of the individualdigital credentials of the first plurality set of digital credentialsthat have been determined to satisfy the verification parameter toverified; verifying the first interdependent credential collection basedon a determination that the status identifiers for each of theindividual digital credentials of the first plurality set of digitalcredentials are set to verified; setting the first interdependentcredential collection status identifier to verified; and digitallysigning the verified first interdependent credential collection.
 11. Themethod of claim 10, wherein each individual digital credential of thefirst plurality of digital credentials is associated with adecentralized identifier.
 12. The method of claim 11, the method furthercomprising implementing a software-as-a-service (SaaS) for validatingthe individual digital credentials of the first plurality of digitalcredentials, wherein validating a first an individual digital credentialof the first plurality of digital credentials comprises: linkingmetadata associated with the first individual digital credential withthe decentralized identifier; formatting an assertion of the firstindividual digital credential in JSON or JSON-LD format, wherein theassertion of the first individual digital credential comprises the datarecord or file representing the individual digital credential; digitallysigning the assertion of the first individual digital credential with aprivate key; and verifying metadata of the first individual digitalcredential with a public key.
 13. The method of claim 10, the methodfurther comprising obtaining one or more of the individual digitalcredentials of the first plurality of cliental credentials are via a theprimary source provider or issuer.
 14. The method of claim 10, themethod further comprising modifying the first interdependent credentialcollection.
 15. The method of claim 10, the method further comprising:receiving, from an entity, an endorsement of the first interdependentcredential collection.
 16. The method of claim 1, wherein the at leastone item of legitimate information is selected from the group consistingof type, issuer, claim, date issued, title, carrier, license, state,driver, birth date, address, expiration date, signature graph, publickey, and identity.
 17. The method of claim 10, the method furthercomprising: defining a second interdependent credential collection, thesecond interdependent credential collection having a secondinterdependent credential collection status identifier indicating astatus of the second interdependent credential collection and comprisinga second plurality of digital credentials, the second plurality ofdigital credentials comprising the first plurality of digitalcredentials of the first interdependent credential collection and atleast one additional credential; and verifying the second interdependentcredential collection based on the first interdependent credentialcollection status identifier and the additional credential withoutverifying any of the individual digital credentials of the firstinterdependent credential collection.
 18. The method of claim 10,wherein the one or more computer memories comprise one or more webservers.